CVE-2025-13990

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13990", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-03T17:09:09.632Z", "datePublished": "2026-01-07T09:21:00.842Z", "dateUpdated": "2026-04-08T17:06:17.678Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:17.678Z"}, "affected": [{"vendor": "mamurjor", "product": "Mamurjor Employee Info", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to create, update, or delete employee records, departments, designations, salary grades, education records, and salary payments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Mamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e323b87-7b2e-4e5c-94a4-a4a0712f50ba?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L10"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L47"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L10"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L47"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "timeline": [{"time": "2026-01-06T20:30:06.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T15:05:19.936612Z", "id": "CVE-2025-13990", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T15:05:28.589Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13990", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T15:05:19.936612Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T15:05:25.446Z"}}], "cna": {"title": "Mamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation", "credits": [{"lang": "en", "type": "finder", "value": "dayea song"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "mamurjor", "product": "Mamurjor Employee Info", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-06T20:30:06.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e323b87-7b2e-4e5c-94a4-a4a0712f50ba?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L10"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L47"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L10"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L47"}], "descriptions": [{"lang": "en", "value": "The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to create, update, or delete employee records, departments, designations, salary grades, education records, and salary payments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:17.678Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13990", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:06:17.678Z", "dateReserved": "2025-12-03T17:09:09.632Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T09:21:00.842Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mamurjor Employee Info", "vendor": "mamurjor", "versions": [{"lessThanOrEqual": "1.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on multiple administrative functions. This makes it possible for unauthenticated attackers to create, update, or delete employee records, departments, designations, salary grades, education records, and salary payments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Mamurjor Employee Info para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 1.0.0, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en m\u00faltiples funciones administrativas. Esto hace posible que atacantes no autenticados creen, actualicen o eliminen registros de empleados, departamentos, designaciones, grados salariales, registros educativos y pagos de salarios a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-13990", "lastModified": "2026-06-17T08:35:07.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13990", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T15:05:19.936612Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:51.043", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L10"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L30"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/tags/1.0.0/admin/admin.php#L47"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L10"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L30"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mamurjor-employee-info/trunk/admin/admin.php#L47"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e323b87-7b2e-4e5c-94a4-a4a0712f50ba?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:36:48.960247+00:00", "value": {"mitigation_remediation": ["Update Mamurjor Employee Info to the latest version, which removes the missing nonce checks, or uninstall the plugin if no newer version is available.", "Restrict access to the WordPress admin dashboard to trusted users and enable two\u2011factor authentication for administrator accounts.", "Monitor the admin panel for unexpected record changes and audit employee data for integrity anomalies."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Request Forgery leading to arbitrary manipulation of employee data and related records"}, "threat_synthesis": {"affected_systems": "The affected vendor is Mamurjor, with the product Mamurjor Employee Info plugin for WordPress. All versions up to and including 1.0.0 are vulnerable, as the issue stems from missing nonce validation across the plugin's administrative interface. No other versions are affected at the time of this advisory, and the issue is specific to WordPress environments that have the plugin activated.", "description_and_impact": "The vulnerability in the Mamurjor Employee Info plugin for WordPress is a classic Cross\u2011Site Request Forgery (CWE\u2011352). Because the plugin does not validate nonces on multiple administrative functions, an attacker can forge a request that forces a logged\u2011in administrator to perform actions such as creating, updating, or deleting employee records, departments, designations, salary grades, education records, and salary payments. The impact is a breach of data integrity and potentially the exposure of sensitive payroll information. Although the attacker does not obtain direct authentication credentials, the ability to manipulate administrative data poses a significant risk for organizations relying on accurate employee information.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to trick a site administrator into executing a forged URL or form, so social engineering is a prerequisite. However, once the admin is convinced, the attacker can manipulate records without further privileges, making the risk significant for data integrity."}}}}, "created": "2026-01-08T09:49:49.182071+00:00", "updated": "2026-04-21T16:45:15.214438+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}